agentlas 1.0.65 → 1.0.66

package/engine/agentlas-tools.cjs

@@ -9,9 +9,11 @@
  */
 const path = require("node:path");
 const fs = require("node:fs");
+const crypto = require("node:crypto");
 const { spawnSync } = require("node:child_process");
 
 const PERM_RANK = { read: 0, write: 1, full: 2 };
+const MAX_TEXT_FILE_BYTES = 8 * 1024 * 1024;
 
 function pathDenied(reason) {
   throw new Error(`workspace path denied: ${reason}`);
@@ -126,9 +128,12 @@ function openRegularFile(file, flags, mode) {
 }
 
 function readUtf8File(file) {
-  if (!fs.statSync(file).isFile()) pathDenied("only regular files may be read");
   const fd = openRegularFile(file, fs.constants.O_RDONLY);
   try {
+    const stat = fs.fstatSync(fd);
+    if (stat.size > MAX_TEXT_FILE_BYTES) {
+      throw new Error(`text file exceeds ${MAX_TEXT_FILE_BYTES} byte limit`);
+    }
     return fs.readFileSync(fd, "utf8");
   } finally {
     fs.closeSync(fd);
@@ -136,6 +141,11 @@ function readUtf8File(file) {
 }
 
 function writeUtf8File(file, content) {
+  if (typeof content !== "string") throw new Error("content must be a string");
+  const contentBytes = Buffer.byteLength(content, "utf8");
+  if (contentBytes > MAX_TEXT_FILE_BYTES) {
+    throw new Error(`text content exceeds ${MAX_TEXT_FILE_BYTES} byte limit`);
+  }
   // Replace through a fresh inode instead of truncating an existing one. If the
   // workspace entry is a hard link to a file elsewhere, this updates only the
   // workspace path and cannot mutate the other link's inode.
@@ -218,6 +228,12 @@ const TOOLS = [
     },
     run(args, ctx) {
       const file = resolveExistingIn(ctx.cwd, args.path);
+      if (args.offset != null && (!Number.isInteger(args.offset) || args.offset < 1)) {
+        throw new Error("offset must be a positive integer");
+      }
+      if (args.limit != null && (!Number.isInteger(args.limit) || args.limit < 1)) {
+        throw new Error("limit must be a positive integer");
+      }
       let content = readUtf8File(file);
       if (args.offset || args.limit) {
         const lines = content.split("\n");
@@ -344,16 +360,17 @@ function toolAskFor(tool, args) {
 function runTool(name, args, ctx) {
   const tool = BY_NAME[name];
   if (!tool) return { ok: false, content: `unknown tool: ${name}` };
+  const context = ctx && typeof ctx === "object" ? ctx : {};
   const ask = toolAskFor(tool, args);
   let ruled = null;
-  if (ctx && ctx.db) {
+  if (context.db) {
     try {
       const permissions = require("./agentlas-permissions.cjs");
-      const verdict = permissions.decideCapability(ctx.db, {
+      const verdict = permissions.decideCapability(context.db, {
         ...ask,
-        permission: ctx.permission,
-        agentId: ctx.agentId,
-        chatId: ctx.chatId,
+        permission: context.permission,
+        agentId: context.agentId,
+        chatId: context.chatId,
       });
       ruled = verdict.ruled;
       if (ruled === "deny") {
@@ -369,15 +386,15 @@ function runTool(name, args, ctx) {
       ruled = null;
     }
   }
-  const rank = PERM_RANK[ctx.permission] ?? 0;
+  const rank = PERM_RANK[context.permission] ?? 0;
   if (ruled !== "allow" && (PERM_RANK[tool.minPerm] ?? 0) > rank) {
     return {
       ok: false,
-      content: `permission denied: '${name}' requires '${tool.minPerm}' but current is '${ctx.permission}'. Ask the user to run /permission ${tool.minPerm}.`,
+      content: `permission denied: '${name}' requires '${tool.minPerm}' but current is '${context.permission || "read"}'. Ask the user to run /permission ${tool.minPerm}.`,
     };
   }
   try {
-    return { ok: true, content: String(tool.run(args || {}, ctx)) };
+    return { ok: true, content: String(tool.run(args || {}, context)) };
   } catch (e) {
     return { ok: false, content: `${name} error: ${e && e.message ? e.message : String(e)}` };
   }
@@ -398,4 +415,14 @@ function openaiTools(permission) {
   }));
 }
 
-module.exports = { TOOLS, BY_NAME, allowedTools, runTool, anthropicTools, openaiTools, PERM_RANK, toolAskFor };
+module.exports = {
+  TOOLS,
+  BY_NAME,
+  allowedTools,
+  runTool,
+  anthropicTools,
+  openaiTools,
+  PERM_RANK,
+  MAX_TEXT_FILE_BYTES,
+  toolAskFor,
+};

package/engine/agentlas-ui.cjs

@@ -116,10 +116,32 @@ function compactHomePath(value) {
   return home && value.startsWith(home + "/") ? "~/" + value.slice(home.length + 1) : value;
 }
 
+function maskSecretValue(value) {
+  const text = String(value || "");
+  const quote = text[0];
+  return (quote === "\"" || quote === "'") && text[text.length - 1] === quote
+    ? quote + "••••" + quote
+    : "••••";
+}
+
 function redactCommandSecrets(value) {
   return value
-    .replace(/\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD))=([^\s]+)/g, "$1=••••")
-    .replace(/\b(authorization\s*:\s*bearer)\s+[^\s]+/gi, "$1 ••••")
+    // URL userinfo is a credential even when it is not an assignment.
+    .replace(/\b(https?:\/\/)[^\s/:@]+:[^\s/@]+@/gi, "$1[redacted]@")
+    // Authorization schemes and common credential-bearing headers. Keep the
+    // header name/scheme visible so the action remains understandable.
+    .replace(/\b((?:proxy-)?authorization\s*[:=]\s*)((?:basic|bearer)\s+)?("[^"]*"|'[^']*'|[^\s"']+)/gi, (_m, prefix, scheme, secret) => prefix + (scheme || "") + maskSecretValue(secret))
+    .replace(/\b((?:x[-_]?api[-_]?key|api[-_]?key|x[-_]?(?:auth(?:entication)?|access|refresh)[-_]?token|x[-_]?(?:client[-_]?secret)|cookie|set[-_]?cookie)\s*:\s*)("[^"]*"|'[^']*'|[^\s"']+)/gi, (_m, prefix, secret) => prefix + maskSecretValue(secret))
+    // Environment assignments are case-insensitive in shells. Keep the
+    // suffix allowlist narrow so ordinary arguments remain readable, while
+    // also covering bare names such as token= and password=.
+    .replace(/(^|[^A-Za-z0-9_])((?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|[A-Za-z0-9]+(?:[_-][A-Za-z0-9]+)*[_-](?:KEY|TOKEN|SECRET|PASSWORD|PASSWD)))(\s*=\s*)("[^"]*"|'[^']*'|[^\s"']+)/gi, (_m, lead, name, equals, secret) => lead + name + equals + maskSecretValue(secret))
+    // Header and CLI bearer forms are common in curl/npm-style commands.
+    .replace(/(\b((?:proxy-)?authorization\s*(?::|=|\s)\s*bearer)\s+)("[^"]*"|'[^']*'|[^\s"']+)/gi, (_m, prefix, _header, secret) => prefix + maskSecretValue(secret))
+    .replace(/(--(?:api[-_]?key|auth(?:entication)?[-_]?token|access[-_]?token|refresh[-_]?token|client[-_]?secret|token|secret|password|passwd)(?:\s*=\s*|\s+))("[^"]*"|'[^']*'|[^\s"']+)/gi, (_m, prefix, secret) => prefix + maskSecretValue(secret))
+    // A standalone bearer value is only masked when it has token-like length;
+    // this avoids turning ordinary prose such as "bearer token" into noise.
+    .replace(/(\bbearer)\s+([A-Za-z0-9._~+/=-]{16,})\b/gi, "$1 ••••")
     // Some remote MCPs put a bearer-like credential in the URL path instead of a header.
     // Keep the provider/path useful while ensuring activity summaries never print the secret.
     .replace(/(https?:\/\/[^\s]+\/)(ocm_[A-Za-z0-9_-]{12,})\b/gi, "$1[redacted]")
@@ -145,7 +167,7 @@ function compactToolArg(name, value, max = 120) {
 }
 
 function compactResult(text, ok, toolName, maxCells = 120) {
-  const clean = stripAnsi(String(text || "")).replace(/\r/g, "").trim();
+  const clean = redactCommandSecrets(stripAnsi(String(text || ""))).replace(/\r/g, "").trim();
   const lines = clean.split("\n").map((line) => line.trim()).filter(Boolean);
   const count = lines.length;
   if (!ok) {
@@ -546,7 +568,7 @@ class Ui {
   toolResult(text, ok = true, options = {}) {
     if (!ok) this._turnFailures += 1;
     if (options.verbose) {
-      const body = truncate(stripAnsi(String(text || "")).trim(), options.maxChars || 4_000);
+      const body = truncate(redactCommandSecrets(stripAnsi(String(text || "")).trim()), options.maxChars || 4_000);
       const lines = body ? body.split("\n") : [ok ? "done" : "error"];
       const marker = ok ? this.c.green("  └ ") : this.c.paw("  └ ");
       for (let index = 0; index < lines.length; index++) {

package/engine/agentlas-workforce.cjs

@@ -4649,18 +4649,42 @@ const TRANSIENT_MODEL_ERROR_RE = /Connection closed mid-response|"terminal_reaso
   function parseArgs(args) {
     const task = [];
     const options = {};
+    const seen = new Set();
+    let passthrough = false;
     for (let index = 0; index < args.length; index += 1) {
       const token = String(args[index]);
-      if (token === "--benchmark") options.benchmark = true;
-      else if (token === "--json") options.json = true;
-      else if (token === "--parallel" || token === "-n") options.concurrency = Number(args[++index]);
-      else task.push(token);
+      if (passthrough) { task.push(token); continue; }
+      if (token === "--") { passthrough = true; continue; }
+      if (token === "--benchmark" || token === "--json") {
+        const key = token.slice(2);
+        if (seen.has(key)) throw new Error(`duplicate option: ${token}`);
+        seen.add(key);
+        options[key] = true;
+      } else if (token === "--parallel" || token === "-n" || token.startsWith("--parallel=")) {
+        if (seen.has("parallel")) throw new Error("duplicate option: --parallel");
+        seen.add("parallel");
+        const inline = token.startsWith("--parallel=");
+        const raw = inline ? token.slice(11) : args[++index];
+        const value = Number(raw);
+        if (raw === undefined || raw === "" || (!inline && String(raw).startsWith("--")) || !Number.isInteger(value) || value < 1 || value > 8) {
+          throw new Error("--parallel requires a positive integer (maximum 8)");
+        }
+        options.concurrency = value;
+      } else if (token.startsWith("-")) {
+        throw new Error(`unknown option: ${token} (use -- before a task token that starts with '-')`);
+      } else task.push(token);
     }
     return { task: task.join(" ").trim(), options };
   }
 
   async function cmdWorkforce(db, args, runtimeOverride, executionContext = {}) {
-    const parsed = parseArgs(args);
+    let parsed;
+    try { parsed = parseArgs(args); }
+    catch (error) {
+      const ui = executionContext.ui || newUi();
+      ui.error(String((error && error.message) || error), { reveal: true });
+      return { ok: false, error: "invalid-arguments" };
+    }
     if (!parsed.task) {
       const ui = executionContext.ui || newUi();
       ui.warn("usage: agentlas workforce <task> [--parallel N] [--benchmark] [--json]");

package/engine/agentlas-workload-routing.cjs

@@ -28,6 +28,52 @@ const EFFORTS = Object.freeze(["none", "minimal", "low", "medium", "high", "xhig
 const EFFORT_TOKEN_RE = /^[a-z][a-z0-9-]{0,23}$/;
 const CAPABILITIES = new Set(["code", "image", "tools", "long-context"]);
 const PHASES = new Set(["plan", "delegate", "synthesize"]);
+const MAX_CODEX_MODEL_CACHE_BYTES = 2 * 1024 * 1024;
+const MAX_DECISION_RECEIPT_BYTES = 16 * 1024 * 1024;
+const MAX_DECISION_RECEIPT_RECORD_BYTES = 1024 * 1024;
+
+function sameFileIdentity(left, right) {
+  return Boolean(left && right && left.dev === right.dev && left.ino === right.ino);
+}
+
+function safeRegularFile(stat, maxBytes, { nonEmpty = false } = {}) {
+  return Boolean(
+    stat && stat.isFile() && !stat.isSymbolicLink() && stat.nlink === 1 &&
+    Number.isSafeInteger(stat.size) && stat.size >= (nonEmpty ? 1 : 0) && stat.size <= maxBytes,
+  );
+}
+
+function readBoundedRegularFile(file, maxBytes) {
+  const before = fs.lstatSync(file);
+  if (!safeRegularFile(before, maxBytes, { nonEmpty: true })) throw new Error("model inventory must be a bounded single-link regular file");
+  const noFollow = fs.constants.O_NOFOLLOW || 0;
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | noFollow);
+  try {
+    const opened = fs.fstatSync(fd);
+    if (!safeRegularFile(opened, maxBytes, { nonEmpty: true }) || !sameFileIdentity(before, opened)) {
+      throw new Error("model inventory changed while opening");
+    }
+    const chunks = [];
+    let total = 0;
+    while (total <= maxBytes) {
+      const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1 - total));
+      const count = fs.readSync(fd, buffer, 0, buffer.length, null);
+      if (!count) break;
+      chunks.push(buffer.subarray(0, count));
+      total += count;
+    }
+    if (total > maxBytes) throw new Error("model inventory exceeds its safety limit");
+    const after = fs.fstatSync(fd);
+    if (
+      !safeRegularFile(after, maxBytes, { nonEmpty: true }) || !sameFileIdentity(opened, after) ||
+      after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs ||
+      total !== after.size
+    ) throw new Error("model inventory changed while reading");
+    return new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks, total));
+  } finally {
+    fs.closeSync(fd);
+  }
+}
 
 function cleanText(value, max = 240) {
   return String(value || "").replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim().slice(0, max);
@@ -161,11 +207,12 @@ function defaultAvailableModels(runtime) {
 }
 
 function readCodexModelInventory(codexHome = process.env.CODEX_HOME || path.join(os.homedir(), ".codex")) {
-  const file = path.join(codexHome, "models_cache.json");
   try {
-    const stat = fs.statSync(file);
-    if (!stat.isFile() || stat.size <= 0 || stat.size > 2 * 1024 * 1024) return [];
-    const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+    const realHome = fs.realpathSync(codexHome);
+    const homeStat = fs.lstatSync(realHome);
+    if (!homeStat.isDirectory() || homeStat.isSymbolicLink()) return [];
+    const file = path.join(realHome, "models_cache.json");
+    const parsed = JSON.parse(readBoundedRegularFile(file, MAX_CODEX_MODEL_CACHE_BYTES));
     if (!Array.isArray(parsed.models)) return [];
     const out = [];
     const seen = new Set();
@@ -517,22 +564,48 @@ function appendDecisionReceipt(receipt, file = defaultReceiptPath()) {
   const directory = path.dirname(file);
   fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
   try { fs.chmodSync(directory, 0o700); } catch { /* Windows/best effort */ }
+  const realDirectory = fs.realpathSync(directory);
+  const directoryStat = fs.lstatSync(realDirectory);
+  if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) {
+    throw new Error("model routing receipt directory must be a real directory");
+  }
+  const target = path.join(realDirectory, path.basename(file));
+  const line = Buffer.from(JSON.stringify(receipt) + "\n", "utf8");
+  if (line.length <= 1 || line.length > MAX_DECISION_RECEIPT_RECORD_BYTES) {
+    throw new Error("model routing receipt record exceeds its safety limit");
+  }
+  let before = null;
   try {
-    const stat = fs.lstatSync(file);
-    if (stat.isSymbolicLink()) throw new Error("model routing receipt path must not be a symlink");
+    before = fs.lstatSync(target);
+    if (before.isSymbolicLink()) {
+      throw new Error("model routing receipt path must not be a symlink");
+    }
+    if (!safeRegularFile(before, MAX_DECISION_RECEIPT_BYTES - line.length)) {
+      throw new Error("model routing receipt path must be a bounded single-link regular file");
+    }
   } catch (error) {
     if (error && error.code !== "ENOENT") throw error;
   }
   const flags = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND | (fs.constants.O_NOFOLLOW || 0);
-  const fd = fs.openSync(file, flags, 0o600);
+  const fd = fs.openSync(target, flags, 0o600);
   try {
-    fs.writeSync(fd, JSON.stringify(receipt) + "\n", null, "utf8");
+    const opened = fs.fstatSync(fd);
+    if (
+      !safeRegularFile(opened, MAX_DECISION_RECEIPT_BYTES - line.length) ||
+      (before && !sameFileIdentity(before, opened))
+    ) throw new Error("model routing receipt changed while opening");
+    fs.fchmodSync(fd, 0o600);
+    const written = fs.writeSync(fd, line, 0, line.length, null);
+    if (written !== line.length) throw new Error("model routing receipt write was incomplete");
     fs.fsyncSync(fd);
+    const after = fs.fstatSync(fd);
+    if (!safeRegularFile(after, MAX_DECISION_RECEIPT_BYTES) || !sameFileIdentity(opened, after)) {
+      throw new Error("model routing receipt changed while writing");
+    }
   } finally {
     fs.closeSync(fd);
   }
-  try { fs.chmodSync(file, 0o600); } catch { /* Windows/best effort */ }
-  return file;
+  return target;
 }
 
 function plannerSystemPrompt({ language = "English", maxTasks = 12, mode = "swarm", liveRuntimeInventory = [] } = {}) {

package/engine/agentlas.cjs

@@ -171,7 +171,14 @@ function main() {
     const code = commands.SELF_HELP_COMMANDS.has(command)
       ? commands.dispatch(ctx, [command, "help"])
       : require("./commands/help.cjs").runForCommand(ctx, command);
-    process.exit(typeof code === "number" ? code : 0);
+    // Self-owned help may be an async native passthrough (Research is the first
+    // such command). Exiting on the unresolved Promise kills its child before
+    // the help text reaches stdout.
+    Promise.resolve(code).then(
+      (n) => process.exit(typeof n === "number" ? n : 0),
+      (error) => { ctx.fail(error); process.exit(1); },
+    );
+    return;
   }
   // 옵션 정규화: -h/--help/-V/--version 은 하위 명령으로 변환
   const normalized = argv.map((a) => {
@@ -199,7 +206,7 @@ function main() {
     const { startRepl } = require("./ui/repl.cjs");
     return startRepl(ctx).then(
       (replCode) => process.exit(replCode || 0),
-      (e) => { ctx.err(String((e && e.message) || e)); process.exit(1); },
+      (e) => { ctx.fail(e); process.exit(1); },
     );
   }
 
@@ -236,7 +243,7 @@ function main() {
 
   Promise.resolve(code).then(
     (n) => process.exit(typeof n === "number" ? n : 0),
-    (e) => { ctx.err(String((e && e.message) || e)); process.exit(1); },
+    (e) => { ctx.fail(e); process.exit(1); },
   );
 }
 

package/engine/agents/builder.cjs

@@ -15,11 +15,14 @@
  * `agentlas import <folder>`로 언제든 설치할 수 있다.
  */
 const crypto = require("node:crypto");
+const path = require("node:path");
 const { runWriteTransaction } = require("../agentlas-sqlite-policy.cjs");
 const { columnExists } = require("../core/db.cjs");
 
 const BUILDER_SLUG = "agentlas-builder";
 const BUILDER_ID = "builtin-agentlas-builder";
+const MAX_BUILDER_OUTPUT_BYTES = 256 * 1024;
+const MAX_BUILT_FOLDER_BYTES = 4 * 1024;
 
 const BUILDER_SYSTEM_PROMPT = [
   "You are the Agentlas local agent builder, running inside the Agentlas terminal.",
@@ -45,12 +48,18 @@ const BUILDER_SYSTEM_PROMPT = [
 function ensureBuilderAgent(db) {
   const now = new Date().toISOString();
   const hasVisibility = columnExists(db, "installed_agents", "visibility");
-  runWriteTransaction(db, () => {
-    const existing = db.prepare("SELECT id FROM installed_agents WHERE id=? OR slug=?").get(BUILDER_ID, BUILDER_SLUG);
-    if (existing) {
-      db.prepare("UPDATE installed_agents SET system_prompt=?, name=?, name_en=?, tagline=?, tagline_en=? WHERE id=?")
-        .run(BUILDER_SYSTEM_PROMPT, "Agent Builder", "Agent Builder", "Builds Agentlas agents locally", "Builds Agentlas agents locally", existing.id);
-      return;
+  const identity = runWriteTransaction(db, () => {
+    const existing = db.prepare("SELECT id, slug FROM installed_agents WHERE id=? OR slug=?").all(BUILDER_ID, BUILDER_SLUG);
+    if (existing.length) {
+      if (existing.length !== 1 || existing[0].id !== BUILDER_ID || existing[0].slug !== BUILDER_SLUG) {
+        throw Object.assign(new Error("The reserved Agentlas builder identity is already used by another installed agent."), { code: "builder_identity_conflict", honestStop: true });
+      }
+      const visibilitySet = hasVisibility ? ", visibility='visible'" : "";
+      db.prepare(
+        `UPDATE installed_agents SET system_prompt=?, name=?, name_en=?, tagline=?, tagline_en=?, ` +
+        `builtin=1, role='orchestrator', tone='blue', trust_grade='A'${visibilitySet} WHERE id=?`,
+      ).run(BUILDER_SYSTEM_PROMPT, "Agent Builder", "Agent Builder", "Builds Agentlas agents locally", "Builds Agentlas agents locally", BUILDER_ID);
+      return { id: BUILDER_ID, slug: BUILDER_SLUG };
     }
     if (hasVisibility) {
       db.prepare(
@@ -63,10 +72,18 @@ function ensureBuilderAgent(db) {
         "VALUES (?,?,?,?,?,?,?,'[]','[]',NULL,'A',?,?,1,?)",
       ).run(BUILDER_ID, BUILDER_SLUG, "Agent Builder", "Agent Builder", "Builds Agentlas agents locally", "Builds Agentlas agents locally", BUILDER_SYSTEM_PROMPT, now, "blue", "orchestrator");
     }
+    return { id: BUILDER_ID, slug: BUILDER_SLUG };
   });
+  const stored = db.prepare("SELECT id, slug, builtin, role FROM installed_agents WHERE id=?").get(BUILDER_ID);
+  if (
+    !stored || stored.id !== identity.id || stored.slug !== identity.slug ||
+    Number(stored.builtin) !== 1 || stored.role !== "orchestrator"
+  ) {
+    throw Object.assign(new Error("The reserved Agentlas builder identity could not be verified after seeding."), { code: "builder_identity_conflict", honestStop: true });
+  }
   return {
-    id: BUILDER_ID,
-    slug: BUILDER_SLUG,
+    id: identity.id,
+    slug: identity.slug,
     name: "Agent Builder",
     nameEn: "Agent Builder",
     systemPrompt: BUILDER_SYSTEM_PROMPT,
@@ -77,10 +94,18 @@ function ensureBuilderAgent(db) {
 
 /** 빌더 산출물 마지막 줄에서 `BUILT: <folder>`를 뽑는다. */
 function parseBuiltFolder(finalText) {
-  const lines = String(finalText || "").split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+  const text = String(finalText || "");
+  if (Buffer.byteLength(text, "utf8") > MAX_BUILDER_OUTPUT_BYTES) return null;
+  const lines = text.split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
   for (let i = lines.length - 1; i >= 0; i -= 1) {
     const m = lines[i].match(/^BUILT:\s*(.+)$/);
-    if (m) return m[1].trim();
+    if (!m) continue;
+    const folder = m[1].trim();
+    if (!folder || Buffer.byteLength(folder, "utf8") > MAX_BUILT_FOLDER_BYTES || /[\u0000-\u001f\u007f]/.test(folder)) return null;
+    if (path.isAbsolute(folder) || /^[A-Za-z]:[\\/]/.test(folder) || folder.includes("\\")) return null;
+    const segments = folder.split("/");
+    if (segments.some((segment) => !segment || segment === "." || segment === "..")) return null;
+    return folder;
   }
   return null;
 }

package/engine/agents/files.cjs

@@ -6,33 +6,68 @@
  * 관찰상 읽기 전용으로 유지돼야 소스 패키지를 재분류하지 않는다.
  */
 const fs = require("node:fs");
+const os = require("node:os");
 const path = require("node:path");
 const { userDataDir } = require("../core/paths.cjs");
 const { routesMap } = require("./routes.cjs");
 
 const CLOUD_RESTORE_MARKER_PATH = ".agentlas-cloud-package.json";
+const NATIVE_CONTEXT_MAX_CHARS = 256 * 1024;
 
 function cloudSlug(value) {
   return (String(value || "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64) || "agentlas-cloud-agent");
 }
 
-function exists(p) { try { fs.accessSync(p); return true; } catch { return false; } }
-
 function agentSystemPrompt(agent) {
-  return agent && agent.systemPrompt ? agent.systemPrompt : `You are ${(agent && agent.name) || "an Agentlas agent"}.`;
+  const value = agent && agent.systemPrompt ? agent.systemPrompt : `You are ${(agent && agent.name) || "an Agentlas agent"}.`;
+  const text = String(value);
+  if (text.length > NATIVE_CONTEXT_MAX_CHARS) throw new Error("agent system prompt exceeds the native context file limit");
+  return text;
+}
+
+function safeExternalAgentPath(value) {
+  if (typeof value !== "string" || !path.isAbsolute(value) || /[\u0000\r\n]/.test(value)) return null;
+  const resolved = path.resolve(value);
+  const unsafe = new Set([path.parse(resolved).root, path.resolve(os.homedir()), path.resolve(userDataDir())]);
+  if (unsafe.has(resolved)) return null;
+  try {
+    const stat = fs.lstatSync(resolved);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) return null;
+    const canonical = fs.realpathSync(resolved);
+    if (unsafe.has(canonical)) return null;
+    return canonical;
+  } catch (error) {
+    // Preserve a safe missing local route for read-only `agentlas cd` output.
+    // The write boundary below refuses to recreate it.
+    return error && error.code === "ENOENT" ? resolved : null;
+  }
+}
+
+function isRegularNoFollow(file) {
+  try {
+    const stat = fs.lstatSync(file);
+    return stat.isFile() && !stat.isSymbolicLink();
+  } catch {
+    return false;
+  }
 }
 
 function agentFolder(agent) {
   const routes = routesMap();
   const r = routes[agent.id];
-  if (r && r.path) return r.path; // 로컬 임포트는 원본 폴더
+  const localPath = safeExternalAgentPath(r && r.path);
+  if (localPath) return localPath; // 로컬 임포트는 원본 폴더
   const cloudRoot = path.join(userDataDir(), "cloud-agent-installs", cloudSlug(agent.slug));
-  if (exists(path.join(cloudRoot, CLOUD_RESTORE_MARKER_PATH))) return cloudRoot;
-  return path.join(userDataDir(), "agents", agent.slug);
+  if (safeExternalAgentPath(cloudRoot) && isRegularNoFollow(path.join(cloudRoot, CLOUD_RESTORE_MARKER_PATH))) return cloudRoot;
+  return path.join(userDataDir(), "agents", cloudSlug(agent.slug));
 }
 
 function writeIfMissing(file, content) {
-  try { fs.lstatSync(file); return false; } catch (error) {
+  try {
+    const stat = fs.lstatSync(file);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw new Error(`native context target must be a regular non-symbolic-link file: ${file}`);
+    return false;
+  } catch (error) {
     if (!error || error.code !== "ENOENT") throw error;
   }
   const fd = fs.openSync(file, "wx", 0o600);
@@ -45,12 +80,40 @@ function writeIfMissing(file, content) {
   return true;
 }
 
+function assertNativeFolder(folder) {
+  if (typeof folder !== "string" || !path.isAbsolute(folder) || /[\u0000\r\n]/.test(folder)) {
+    throw new Error("native context folder must be an absolute safe path");
+  }
+  const resolved = path.resolve(folder);
+  const data = path.resolve(userDataDir());
+  const internalRoots = [path.join(data, "agents"), path.join(data, "cloud-agent-installs")];
+  const internal = internalRoots.some((root) => resolved.startsWith(root + path.sep));
+  const unsafe = new Set([path.parse(resolved).root, path.resolve(os.homedir()), data]);
+  if (unsafe.has(resolved)) throw new Error("refusing to write native context files to a broad user/system directory");
+  try {
+    const stat = fs.lstatSync(resolved);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error("native context folder must be a real directory");
+    const canonical = fs.realpathSync(resolved);
+    if (unsafe.has(canonical)) throw new Error("refusing to write native context files to a broad user/system directory");
+    return canonical;
+  } catch (error) {
+    if (!error || error.code !== "ENOENT") throw error;
+    if (!internal) throw new Error("refusing to recreate a missing imported agent source folder");
+    fs.mkdirSync(resolved, { recursive: true });
+    const created = fs.lstatSync(resolved);
+    if (created.isSymbolicLink() || !created.isDirectory()) throw new Error("native context folder changed type during creation");
+  }
+  return resolved;
+}
+
 function ensureNativeFiles(agent, folder) {
-  fs.mkdirSync(folder, { recursive: true });
+  folder = assertNativeFolder(folder);
   const sys = agentSystemPrompt(agent);
   const created = [];
   if (writeIfMissing(path.join(folder, "system-prompt.md"), sys)) created.push("system-prompt.md");
-  const header = `# ${agent.name}\n\n${agent.tagline || ""}\n\n${sys}\n`;
+  const name = String(agent.name || agent.slug || "Agentlas agent").replace(/[\u0000\r\n]/g, " ").slice(0, 500);
+  const tagline = String(agent.tagline || "").replace(/[\u0000\r]/g, " ").slice(0, 2_000);
+  const header = `# ${name}\n\n${tagline}\n\n${sys}\n`;
   // 네이티브 CLI가 프로젝트 지시로 자동 인식하는 파일들
   if (writeIfMissing(path.join(folder, "CLAUDE.md"), header)) created.push("CLAUDE.md");
   if (writeIfMissing(path.join(folder, "AGENTS.md"), header)) created.push("AGENTS.md");
@@ -58,4 +121,12 @@ function ensureNativeFiles(agent, folder) {
   return created;
 }
 
-module.exports = { agentFolder, ensureNativeFiles, agentSystemPrompt, cloudSlug, CLOUD_RESTORE_MARKER_PATH };
+module.exports = {
+  agentFolder,
+  ensureNativeFiles,
+  agentSystemPrompt,
+  cloudSlug,
+  safeExternalAgentPath,
+  assertNativeFolder,
+  CLOUD_RESTORE_MARKER_PATH,
+};

package/engine/agents/import-local.cjs

@@ -5,10 +5,12 @@
  * v1 모놀리스 890–1112 구간의 충실 이식 — 규칙 변경 금지(데스크탑과 판정 동형이어야 함).
  */
 const fs = require("node:fs");
+const os = require("node:os");
 const path = require("node:path");
 const crypto = require("node:crypto");
 const { tableExists, columnExists } = require("../core/db.cjs");
 const { routesMap, saveRoutes } = require("./routes.cjs");
+const { userDataDir } = require("../core/paths.cjs");
 
 function exists(p) { try { fs.accessSync(p); return true; } catch { return false; } }
 function isDir(p) { try { return fs.statSync(p).isDirectory(); } catch { return false; } }
@@ -159,8 +161,14 @@ function upsertLocalTeamFirm(db, dir, ceoAgentId, agentSlug, name, tagline) {
 }
 
 function importLocalFolder(db, absPath) {
-  const dir = path.resolve(absPath);
-  if (!isDir(dir)) throw new Error(`Not a directory: ${absPath}`);
+  const requested = path.resolve(absPath);
+  const unsafe = new Set([path.parse(requested).root, path.resolve(os.homedir()), path.resolve(userDataDir())]);
+  if (unsafe.has(requested)) throw new Error(`Refusing to import a broad user/system directory: ${absPath}`);
+  let stat;
+  try { stat = fs.lstatSync(requested); } catch { throw new Error(`Not a directory: ${absPath}`); }
+  if (stat.isSymbolicLink() || !stat.isDirectory()) throw new Error(`Imported agent path must be a real non-symbolic-link directory: ${absPath}`);
+  const dir = fs.realpathSync(requested);
+  if (unsafe.has(dir)) throw new Error(`Refusing to import a broad user/system directory: ${absPath}`);
   const labels = detectRuntimeLabels(dir);
   const runtime = labels[0];
   const kind = detectKind(dir);

package/engine/agents/registry.cjs

@@ -122,9 +122,16 @@ function findAgent(db, token) {
   const q = String(token || "").trim().toLowerCase();
   if (!q) return null;
   const agents = listRoutableAgents(db);
-  const exact = agents.find((a) => a.slug.toLowerCase() === q || a.id === token)
-    || agents.find((a) => (a.name || "").toLowerCase() === q || (a.nameEn || "").toLowerCase() === q);
-  if (exact) return exact;
+  const exactId = agents.find((agent) => agent.id === token);
+  if (exactId) return exactId; // primary key is authoritative
+  const exactSlug = agents.filter((agent) => agent.slug.toLowerCase() === q);
+  if (exactSlug.length === 1) return exactSlug[0];
+  if (exactSlug.length > 1) return null;
+  const exactName = agents.filter((agent) =>
+    (agent.name || "").toLowerCase() === q || (agent.nameEn || "").toLowerCase() === q,
+  );
+  if (exactName.length === 1) return exactName[0];
+  if (exactName.length > 1) return null;
   const partial = agents.filter((a) =>
     a.slug.toLowerCase().includes(q) || (a.name || "").toLowerCase().includes(q) || (a.nameEn || "").toLowerCase().includes(q));
   if (partial.length === 1) return partial[0];